And may the book begin!
Now for the formatting and diskpart stuff.A quick format: is a formatting option that creates a new file table on a hard disk but does not fully overwrite or erase the disk. Quick formatting erases/rewites the FT (File Table) of the File System partition. So basically quick formatting just erases/rewrites anew what is essentially a directory that tells the operating system where files are and what spaces are free to write new data on.A full format: is a formatting option that creates a new file table on a hard disk and does fully overwrite and erase the disk. (Except the Boot Sector) A full format erases/rewrites the FT (File Table) of the File System partition and runs chkdsk. Chkdsk does one pass of writing zero's to the drive to ensure that the sectors are working properly. This is why full formats take so much longer. So basically a full format is quick format + Chkdsk.
Windows formatting is only going to give you the choice of a FAT or MFT because FAT file systems and NTFS is all it deals with?The "clean" command in DiskPart:
The "clean" command wipes all the File Tables on the disk. Thus leaving no user viewable data.The "clean all" command in DiskPart:
The "clean" command wipes all the File Tables on the disk and writes zero's to all the parts of the drive. (Except the Boot Sector)
Thanks for the help
LOL, wow, I gotz soz many questions lol...lets just do this 1 step at a time, I am in no rush at all.

Hi Sean, i think you will find the "clean" command in diskpart regarding ssd only marks files to allow them to be overwriiten..it does not wipe them. With a C300 I had i tried that command and the "clean all". Using the clean command and a fresh install of win 7 WEI the drive only got 7.7 and lowish scores in asssd and atto. I then wiped it using the "clean all" command and back to 7.9 in WEI and tops marks in asssd and atto...This was just testing for testings sake! Usually I use Partedmagic if Iam going to erase

...Found this:- This will show you how to use the clean command on a selected disk to delete all of it's MBR or GPT partitions, volumes, and any hidden sector information on MBR disks is overwritten. The data on the HDD is not written over using the clean command like it does with the clean all command below. With the clean command, the data on the HDD is only marked as being deleted instead and is only written over when new data is written/saved to the same location on the HDD next.

A full format erases the FAT and MFT and scans for bad sectors, via chckdsk and does one pass of writing one's or zero's to the drive.

because I didn't see it mentioned, I wanted to point out that end users cannot do a true "low level" format of a drive anymore, and haven't been able to since the 1990s. That type of work (marking the disk so the controller knows what's what) is now done at the factory, and if you were able to erase these marks (say, with a degausser), the drive would be unsalvageable.

I just wanted to point out the difference between a quick format, a "full" format, and a real low level format.

I'm going to oversimplify this for demonstration purposes:
Here's a harddrive you could low level format, as there are finite positions for the heads to go to (not including offsets):
and a "much newer" drive that can't be:Edited by u3b3rg33k - 1/3/12 at 8:48am

Looked back at your previous post. A "full format" writes data to the drive, but think about how Check Disk (which is part of the full format) works on a drive that contains an operating system.

Check disk writes to all the sectors of a drive, if you have it do a surface scan, yet when it is done, your system will still boot. Why? Because after it writes and reads the "0" or "1", confirms the viability of the sector, it puts the original information back into the sector. The "clean" command with the "all" switch just basically does the same thing on a disk level rather than a partition level.

Just to clarify (i think I did in my last post). the "master partition table" resides in what you call the boot sector (It is "technically" the Master Boot Record) of the drive. This table is created when the initial "formatting" of the drive is done, at the factory. Almost all drives shipped from manufacturing plants are configured as MBR drives. It used to be (and in some cases still is), that they would be idenifiable as "Volume Boot Records", but either way (MBR/VBR), information is still contained in the first few sectors in order to identify the disk. This information is already written to the begining of the drive when you purchase it. I've only mentioned MBR and GPT, as they are the two "drive" systems that most on this forum will encounter. Apple's storage system uses a form of GPT, so the basic information also encompasses Apple computers. GPT requires less space in this space of the drive, as GPT does not use a "table" (as opposed to MBR) to store partition information Instead, GPT contains a partition header that only contains the location (on the drive) of the begining of the GPT partition. GUID partitions are "self identifying", meaning that the information that would typically be necessary under MBR, is now contained at the begining of the partition itself (and at the end, for redundency).

When you create a partition on a drive, (in the case of diskpart), diskpart modifies the partition table that is already there. When we talk ablout the difference between MBR and GPT, the space in this partition table is limited with MBR. Here I go with another bad analogy: Think of the partition table as a "Word" table that only has 4 rows and 2 columns. This gives you the ability to plug in information for 4 distinct partitions, along with all the necessary information to identify and configure the partiton (ie LBA addresses) on the drive. Because every piece of information pertaining to the partition must be stored in this table, this info starts to take up a lot of space in the limited space it is given. What happens when you need a 5th partition. Step in GPT. In GPT, GPT uses a header, rathar than a table, which is one of the reasons that MBR is limited in the number of Partitions that can be created. the "header" contains usually nothing more than the partitions location on the drive.

Anyway, when using DiskPart, you are typically only manipulating either the partition table (in MBR) or the GPT header.Edited by xandypx - 1/3/12 at 9:48am

Ok, so here are some of the definitions I have made from the information I have read. Please correct a definition if it is wrong or if it needs more info, thanks.

So far what I have learned is that…

Boot sector:
The boot sector is contained within the first 33 sectors of a HDD starting at sector 0. It refers to the very beginning of the drive. Within the boot sector is all the things you said, contains the disk identifier, primary partition table (this is blank, but is still contained on the drive on an unpartitioned drive), the disk signature, the location of the bootstrap code, etc.
This part of any drive is not erased, secure erased, or even manipulated by cleaning/formatting the disk. As it takes very specific commands to modify the information contained in these first few sectors (in the case of a HDD, the first 33).

If the information contained on this part of the disk (identifying the disk type MBR, GPT, Apple...etc...) were to become corrupted or "cleared," you could just toss the disk. No "normal" user program would be able to see, let alone manipulate the disk in order to attempt to rewrite these "sectors". Probably a bad analogy, but think of this area of the disk like the hard coded BIOS or UEFI of your motherboard. If the code gets corrupted, or disappears nothing can happen. In the case of a "drive", the BIOS/UEFI has to be able to read these first sectors in order for the BIOS to know that what it is looking at is actually a "fixed" drive. There will be no info and the drive will not appear in the BIOS/UEFI.

TL;DR: Boot Sector = First 33 sectors of a disk.

Primary partition table: (aka. “Master partition table”)
A primary partition table is contained within the boot sector; it is blank on an unpartitioned drive. This table is created when the initial "formatting" of the drive is done, at the factory. Almost all drives shipped from manufacturing plants are configured as MBR drives. It used to be (and in some cases still is), that they would be identifiable as "Volume Boot Records", but either way (MBR/VBR), information is still contained in the first few sectors in order to identify the disk. This information is already written to the beginning of the drive when you purchase it.

TL;DR: Primary Parition = Very important data in the boot sector, sets up the disk for use.

MBR and GPT Partition Tables:
I've only mentioned MBR and GPT, as they are the two "drive" systems that most on this forum will encounter. Apple's storage system uses a form of GPT, so the basic information also encompasses Apple computers. GPT requires less space in this space of the drive, as GPT does not use a "table" (as opposed to MBR) to store partition information. Instead, GPT contains a partition header that only contains the location (on the drive) of the beginning of the GPT partition. GUID partitions are "self-identifying", meaning that the information that would typically be necessary under MBR is now contained at the beginning of the partition itself (and at the end, for redundancy). GPT is more of an evolution of MBR, much like NTFS was to FAT. The "evolution" addresses the shortcomings of the previous "system".

TL;DR: MBR and GPT Partition Tables = Types of primary partitions

Diskpart and Partition Tables:
When you create a partition on a drive, (in the case of diskpart), diskpart modifies the partition table that is already there. When we talk about the difference between MBR and GPT, the space in this partition table is limited with MBR. Here I go with another bad analogy: Think of the partition table as a "Word" table that only has 4 rows and 2 columns. This gives you the ability to plug in information for 4 distinct partitions, along with all the necessary information to identify and configure the partition (i.e. LBA addresses) on the drive. Because every piece of information pertaining to the partition must be stored in this table, this info starts to take up a lot of space in the limited space it is given. What happens when you need a 5th partition? Step in GPT. In GPT, GPT uses a header, rather than a table, which is one of the reasons that MBR is limited in the number of Partitions that can be created. The "header" contains usually nothing more than the partitions location on the drive. Anyway, when using DiskPart, you are typically only manipulating either the partition table (in MBR) or the GPT header.

TL;DR: How diskpart can work with partitions

File System:
The file system is a digital storage medium comprised of bytes organized in a specific way on physical hardware. It sets the way the data will be stored, retrieved and updated.

File Table:
A file table is the part of the file system that makes it what it is. It describes all files on the volume, for example where each are located on the drive. Every file system has a "file table". In windows; FAT for FAT (12, 16, 32, X), and MFT for NTFS.

FAT vs. MFT:
One of the key difference is that the MFT actually appears twice (there are two copies of it) in NTFS. The NTFS keeps a backup of the File table (MFT), in case the one it is using becomes corrupt. It will then use the backup copy, and rewrite the corrupt one as the new backup. This redundancy is to improve reliability…there is more, but not needed to get into at this time
Quick format:
A quick format is a formatting option that creates a new file table on a hard disk but does not fully overwrite or erase the disk. Quick formatting erases and rewrites the file table of the file system partition.

Full format:
A full format is a formatting option that creates a new file table on a hard disk and also does not fully overwrite and erase the disk. A full format erases and rewrites the file table of the file system partition and runs chkdsk. Check disk writes to all the sectors of a drive, if you have it do a surface scan, yet when it is done, your system will still boot. Why? Because after it writes and reads the "0" or "1", confirms the viability of the sector, it puts the original information back into the sector. This is why full formats take so much longer and don’t erase your data. So basically a full format is quick format + Chkdsk.

The "clean" command in DiskPart:
The "clean" command marks all of a drives partitions, volumes, and any hidden sector information as deleted and they are only written over when new data is written/saved to the same location on the drive next.

The "clean all" command in DiskPart:
The "clean all" command deletes all of a drives partitions, volumes, and any hidden sector information and then writes zero's to all the parts of the drive.

Quote:

Check disk writes to all the sectors of a drive, if you have it do a surface scan, yet when it is done, your system will still boot. Why? Because after it writes and reads the "0" or "1", confirms the viability of the sector, it puts the original information back into the sector. The "clean" command with the "all" switch just basically does the same thing on a disk level rather than a partition level.

So it does or doesn’t rewrite the previous data with the clean all?

Secure erase:
Secure erase is where the SSD controller issues a command that applies a voltage spike at a specific voltage to all of the NAND simultaneously, thus cleaning the NAND. This in turn resets all the NAND cells on the SSD and leaves the drive erased.

Ok, so here are some of the definitions I have made from the information I have read. Please correct a definition if it is wrong or if it needs more info, thanks.

So far what I have learned is that…

Boot sector:
The boot sector is contained within the first 33 sectors of a HDD starting at sector 0. It refers to the very beginning of the drive. Within the boot sector is all the things you said, contains the disk identifier, primary partition table (this is blank, but is still contained on the drive on an unpartitioned drive), the disk signature, the location of the bootstrap code, etc.
This part of any drive is not erased, secure erased, or even manipulated by cleaning/formatting the disk. As it takes very specific commands to modify the information contained in these first few sectors (in the case of a HDD, the first 33).

If the information contained on this part of the disk (identifying the disk type MBR, GPT, Apple...etc...) were to become corrupted or "cleared," you could just toss the disk. No "normal" user program would be able to see, let alone manipulate the disk in order to attempt to rewrite these "sectors". Probably a bad analogy, but think of this area of the disk like the hard coded BIOS or UEFI of your motherboard. If the code gets corrupted, or disappears nothing can happen. In the case of a "drive", the BIOS/UEFI has to be able to read these first sectors in order for the BIOS to know that what it is looking at is actually a "fixed" drive. There will be no info and the drive will not appear in the BIOS/UEFI.

TL;DR: Boot Sector = First 33 sectors of a disk.

Primary partition table: (aka. “Master partition table”)
A primary partition table is contained within the boot sector; it is blank on an unpartitioned drive. This table is created when the initial "formatting" of the drive is done, at the factory. Almost all drives shipped from manufacturing plants are configured as MBR drives. It used to be (and in some cases still is), that they would be identifiable as "Volume Boot Records", but either way (MBR/VBR), information is still contained in the first few sectors in order to identify the disk. This information is already written to the beginning of the drive when you purchase it.

TL;DR: Primary Parition = Very important data in the boot sector, sets up the disk for use.

MBR and GPT Partition Tables:
I've only mentioned MBR and GPT, as they are the two "drive" systems that most on this forum will encounter. Apple's storage system uses a form of GPT, so the basic information also encompasses Apple computers. GPT requires less space in this space of the drive, as GPT does not use a "table" (as opposed to MBR) to store partition information. Instead, GPT contains a partition header that only contains the location (on the drive) of the beginning of the GPT partition. GUID partitions are "self-identifying", meaning that the information that would typically be necessary under MBR is now contained at the beginning of the partition itself (and at the end, for redundancy). GPT is more of an evolution of MBR, much like NTFS was to FAT. The "evolution" addresses the shortcomings of the previous "system".

TL;DR: MBR and GPT Partition Tables = Types of primary partitions

Diskpart and Partition Tables:
When you create a partition on a drive, (in the case of diskpart), diskpart modifies the partition table that is already there. When we talk about the difference between MBR and GPT, the space in this partition table is limited with MBR. Here I go with another bad analogy: Think of the partition table as a "Word" table that only has 4 rows and 2 columns. This gives you the ability to plug in information for 4 distinct partitions, along with all the necessary information to identify and configure the partition (i.e. LBA addresses) on the drive. Because every piece of information pertaining to the partition must be stored in this table, this info starts to take up a lot of space in the limited space it is given. What happens when you need a 5th partition? Step in GPT. In GPT, GPT uses a header, rather than a table, which is one of the reasons that MBR is limited in the number of Partitions that can be created. The "header" contains usually nothing more than the partitions location on the drive. Anyway, when using DiskPart, you are typically only manipulating either the partition table (in MBR) or the GPT header.

TL;DR: How diskpart can work with partitions

File System:
The file system is a digital storage medium comprised of bytes organized in a specific way on physical hardware. It sets the way the data will be stored, retrieved and updated.

File Table:
A file table is the part of the file system that makes it what it is. It describes all files on the volume, for example where each are located on the drive. Every file system has a "file table". In windows; FAT for FAT (12, 16, 32, X), and MFT for NTFS.

FAT vs. MFT:
One of the key difference is that the MFT actually appears twice (there are two copies of it) in NTFS. The NTFS keeps a backup of the File table (MFT), in case the one it is using becomes corrupt. It will then use the backup copy, and rewrite the corrupt one as the new backup. This redundancy is to improve reliability…there is more, but not needed to get into at this time
Quick format:
A quick format is a formatting option that creates a new file table on a hard disk but does not fully overwrite or erase the disk. Quick formatting erases and rewrites the file table of the file system partition.

Full format:
A full format is a formatting option that creates a new file table on a hard disk and also does not fully overwrite and erase the disk. A full format erases and rewrites the file table of the file system partition and runs chkdsk. Check disk writes to all the sectors of a drive, if you have it do a surface scan, yet when it is done, your system will still boot. Why? Because after it writes and reads the "0" or "1", confirms the viability of the sector, it puts the original information back into the sector. This is why full formats take so much longer and don’t erase your data. So basically a full format is quick format + Chkdsk.

The "clean" command in DiskPart:
The "clean" command marks all of a drives partitions, volumes, and any hidden sector information as deleted and they are only written over when new data is written/saved to the same location on the drive next.

The "clean all" command in DiskPart:
The "clean all" command deletes all of a drives partitions, volumes, and any hidden sector information and then writes zero's to all the parts of the drive.

Quote:

Check disk writes to all the sectors of a drive, if you have it do a surface scan, yet when it is done, your system will still boot. Why? Because after it writes and reads the "0" or "1", confirms the viability of the sector, it puts the original information back into the sector. The "clean" command with the "all" switch just basically does the same thing on a disk level rather than a partition level.

So it does or doesn’t rewrite the previous data with the clean all?

Talking about two seperate things (running chkdisk with an intact OS on its own (at the partition level), and one where the partition table has been cleared by diskpart), although basically the same. DiskPart works on a disk level, chkdsk on its own works on a partition level (ie. your C:\ drive), just like the "format" command. If you have a functing installation, the system will still boot because after the chkdisk run, the partition locations are still referenced by the partition table, and in turn, the File Table of the Partition itself. When in Diskpart, the "clean" command clears the partition table, and leaves no reference to where the partitions are (were) located on the drive... the data may still be contained in the storage locations (sectors), but without a functioning partition table (the index for the partitions), the system can't boot.

Quote:

Originally Posted by Sean Webster

Secure erase:
Secure erase is where the SSD controller issues a command that applies a voltage spike at a specific voltage to all of the NAND simultaneously, thus cleaning the NAND. This in turn resets all the NAND cells on the SSD and leaves the drive erased.

Basically means that chkdisk runs by itself when initiated by the OS, and leaves everything in tact when finished. When run from within windows, chkdisk usually only runs on a partition level. For example, if you have a large HDD of say 1TB, but you have partitioned into 2-500GB partitions (labeled C:\ & D:\)... When you select the disk properties (for say the D:\ drive) from within windows, select the "tools" tab, and run chkdisk, checkdisk will only check the portion of the drive associated with that 500GB partition. It will not check the portion of the drive associated with C:\.

DiskPart on the other hand works with the entire drive. It will work only with select areas of a drive, only if you tell it to (ie. select partition #). When you issue the "clean" command in Diskpart, what you are actually doing is wiping out (clearing the data from) the partition table. basically the data is marked as deleted, but it really is still on the drive. just like when it is run in windows.

I think I see what you mean... I didn't finish.

With the "/all" switch, after clearing the partition table, it runs the chkdisk program the same way on the drive like when run from windows. This would normally leave the actual data in tact on the drive, but the switch also tells diskpart to overwrite the drive with "0's", which it does.

Don't get the impression that writing 0s to a drive makes data that was contained on the drive unrecoverable. Unless you overwrite a mechanical HDD quite a few times with random data, forensic software can still recover a one pass "0" written drive.

Ok, cool I think I get that now.

Now, HDD anatomy? lol

So I know the basics on the layout and how it works and all. But I want to know more about the platters and the controllers.Platters
-Sectors
-Clusters
-etc?

Controller
ECC

SSD anatomy

NAND
-rather than sectors they are pages?

Controller
ECC
Secure erase

Also, touch on firmware, like what exactly is its job. I just know it makes the hardware and software work together, but any more detail into it I should get to know?